DPH creates Compliance and Privacy Office after year of whistleblower complaints and data breaches

Maria Martinez, director of the Office of Compliance and Privacy Affairs, told the San Francisco Department of Public Health (DPH) Health Commission on Nov. 3 that the department has consolidated compliance and privacy functions into a single office reporting to the director to reduce risk and improve oversight.

Martinez said the office will standardize risk assessments, audits and corrective action planning across hospitals, ambulatory care and behavioral health, and will work closely with quality management, human resources and IT to protect patient confidentiality while enabling appropriate data sharing to support care and program evaluation.

Martinez reported roughly 80 whistleblower complaints in the last fiscal year, about half centering on human‑resources issues and half involving allegations of fraud or abuse. Of the 65 cases closed so far, she said about half were unsubstantiated and the remainder required corrective action; four to five employees had their employment status affected as a result of substantiated findings.

On breaches, Martinez said DPH reported 13 incidents in the year, with about three‑quarters attributable to staff removing protected health information from secure areas (USB drives or laptops) and losing devices or having them stolen. She estimated a little less than $500,000 in fines would be assigned to the last fiscal year and singled out an ongoing theft ‘‘Stiver’’ case involving roughly 66,000 documents that could lead to multi‑million‑dollar penalties and a large review workload for privacy staff.

Martinez described several reforms: a single toll‑free hotline for whistleblower and breach reporting, new business‑associate agreements and attestations requiring contractors (and their boards) to affirm compliance with data‑security requirements, and plans to create a data‑sharing governance committee to vet research and evaluation requests and improve care coordination.

In public comment, Derek Kerr, identifying himself as a DPH whistleblower, welcomed the disclosure of 80 complaints but urged commissioners to examine whether internal human‑resources investigations create conflicts of interest when complaints concern senior officials. Kerr said whistleblowers often face retaliation and asked the commission to monitor outcomes for complainants (for example, resignations or layoffs) following reports of misconduct.

Commissioners asked for more detail on procedures for handling complaints about senior executives, and Martinez said those complaints are routed in coordination with the controller’s office so sensitive cases can be handled outside the department when required. She said Ravi Mehta is the primary investigator handling whistleblower intake and that investigations are coordinated across central investigative units and relevant local units depending on the allegation (billing, human resources, contractor conduct).

Martinez also highlighted an implementation focus on staff training and behavior change, noting institutional hospitals generally have higher training completion rates than community ambulatory clinics and that part of the office’s work is improving contractor and community provider compliance.

The commission asked for a follow‑up report in about six months to review staffing, training progress and outcomes from the new office.